CVE-2026-78669 Excessive CPU consumption from repeated initial window changes in net/http
A malicious HTTP/2 peer can cause excessive CPU consumption in Go applications by sending repeated small SETTINGS frames, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-78669?
CVE-2026-78669 is a high-severity denial of service vulnerability in golang.org/x/net/http2, published on 8 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.
Weakness: CWE-405
Which versions are affected by CVE-2026-78669?
4 open source packages ship an affected version, including stdlib, golang and golang.org/x/net.
| Package | Affected | Fixed in |
|---|---|---|
stdlib Go | All versions | 1.26.9 |
stdlib Go | From 1.27.0-0 | 1.27.2 |
golang Bitnami | All versions | 1.26.9, 1.27.2 |
golang.org/x/net Go | All versions | 0.60.0 |
Linux distribution packages (8)
cadvisor openSUSE:Leap 16.0 | All versions | 0.60.6-bp160.2.1 |
azure-storage-azcopy openSUSE:Tumbleweed | All versions | 10.32.8-2.1 |
coredns openSUSE:Tumbleweed | All versions | 1.15.0-1.1 |
distribution openSUSE:Tumbleweed | All versions | 3.1.2-2.1 |
google-guest-agent openSUSE:Tumbleweed | All versions | 20261015.00-1.1 |
hauler openSUSE:Tumbleweed | All versions | 2.1.2-1.1 |
helm openSUSE:Tumbleweed | All versions | 4.3.0-5.1 |
helm3 openSUSE:Tumbleweed | All versions | 3.22.1-1.1 |
How do I fix CVE-2026-78669?
Upgrade stdlib to a fixed version for your release line: 1.26.9 or 1.27.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-78669 being exploited?
There is no known exploitation of CVE-2026-78669 in the wild and no public exploit code.
Sources
Also known as AZL-107027, AZL-107045, AZL-107075, AZL-107102, AZL-107126, AZL-107138 and 1108 more.